6 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
aweiker	8c8f3ab4b3	feat(#123): add IP-level SSRF defense to Gitea client and action ... ## Changes ### Go: IP-level SSRF protection in gitea.Client (primary defense) - Add gitea/ipcheck.go with IsBlockedIP() covering all blocked CIDR ranges: loopback (127.0.0.0/8, ::1), RFC1918 (10/8, 172.16/12, 192.168/16), link-local (169.254/16, fe80::/10), ULA (fc00::/7), CGN (100.64/10), multicast, reserved, and unspecified ranges. - IPv6-mapped IPv4 addresses (::ffff:x.x.x.x) are normalized before checking. - Add safeDialContext to gitea.Client: resolves DNS, rejects any IP in a blocked CIDR, then dials the resolved IP directly to narrow the DNS rebinding window. NewClient now uses this safe transport by default. - Add WithUnsafeDialer() for test code using httptest.Server (127.0.0.1). - Update NewTestClient helper in export_test.go for all gitea unit tests. - Update SetHTTPClient(nil) to restore the safe transport (not the plain one). ### Go: validate-url subcommand (defense-in-depth for future bash callers) - Add 'review-bot validate-url <url>' subcommand: validates https scheme, no user-info, resolves hostname, rejects any blocked IP. - Exit 0=safe, 1=blocked, 2=validation error/dns failure. - Add outWriter/errWriter vars to main.go for testable output capture. ### action.yml: Python3 IP check in 'Determine version' step - After the https scheme validation, resolve SERVER_URL hostname with socket.getaddrinfo and reject any result where ipaddress.ip_address(ip).is_private/is_loopback/is_link_local/etc. is true. - python3 is required on ubuntu-* runners (noted in existing comments). - Covers the version-check curl that sends ACTION_TOKEN to SERVER_URL. - SERVER_URL for install-step curls is covered by the same pre-check. ### Tests - gitea/ipcheck_test.go: 30+ cases covering all blocked families + public IPs - gitea/client_test.go: safe transport presence, WithUnsafeDialer, SSRF blocking - cmd/review-bot/validateurl_test.go: scheme validation, user-info, exit codes Closes #123	2026-05-14 07:44:51 +00:00
aweiker	50facefdd6	Merge PR #121: fix(action): detect VCS host type for version resolution and binary download ... This PR addresses issue #120 by adding GitHub/GHES support to the composite action. Key improvements: - Detects VCS host type via github.api_url presence (GitHub/GHES vs Gitea) - Uses correct API paths: /api/v3 for GitHub, /api/v1 for Gitea - Prevents token exfiltration by ignoring inputs.vcs-url on GitHub runners - Validates inputs (action-repo format, URL scheme, tokens) - Adds multi-arch support (uname-derived binary/OS detection) - Reuses computed values across steps via GITHUB_OUTPUT - Properly handles private release assets on GitHub via REST API - Backward compatible with existing Gitea workflows Reviewed and approved by sonnet-review, gpt-review, and security-review.	2026-05-14 07:28:43 +00:00
aweiker	bd2df7d986	feat(#120): add GitHub Actions support with VCS host detection and security hardening ... - Detect VCS host type from github.api_url (present on GitHub/GHES, absent on Gitea) - Add action-repo input: specifies repo hosting review-bot releases, separate from the reviewed repo. Defaults to github.action_repository, then rodin/review-bot. - Add action-repo-token input: auth for release downloads (defaults to github.token on GitHub, reviewer-token on Gitea). - GitHub/GHES path: use github.api_url for version resolution and REST API asset download endpoint (required for private repos; web URLs redirect to S3 and don't support Authorization headers reliably). - Gitea path: use validated SERVER_URL with direct download (no -L; prevents Authorization forwarding on potential CDN redirects). - Security hardening: - inputs.vcs-url is IGNORED on GitHub/GHES to prevent token exfiltration - SERVER_URL validated for https scheme and no whitespace on Gitea path - action-repo validated against owner/repo pattern (prevent path traversal) - VERSION validated for no slashes/whitespace - TOKEN validated for no control characters (header injection defense) - ACTION_TOKEN passed via ::add-mask:: + GITHUB_ENV (not step output, which can leak in debug logs) - set -euo pipefail in both script steps - Multi-arch support: OS/arch detection via uname (linux/darwin, amd64/arm64) for cache key and binary name — incorporates changes from #124 - Run review step: passes VCS_URL from step output (server_url) instead of direct input expression Closes #120	2026-05-14 07:14:58 +00:00
aweiker	d3bb83a10a	docs(#125): update CLI example to use --vcs-url instead of deprecated --gitea-url	2026-05-14 06:50:21 +00:00
aweiker	f8b9d7d282	fix: portable checksum on darwin, anchor grep pattern ... - sha256sum is not available on macOS; use shasum -a 256 on darwin. Select based on steps.version.outputs.os which is already computed. Fixes MAJOR finding from gpt-review-bot (PR #127 review). - Anchor checksum grep with ^ to avoid matching on partial lines. Fixes MINOR finding from gpt-review-bot (PR #127 review).	2026-05-14 05:48:21 +00:00
aweiker	7a8fc166ec	feat(action): derive binary name from uname for multi-arch support (#124) ... Previously the Install step hard-coded 'review-bot-linux-amd64'. This fails on arm64 runners (Graviton, Apple Silicon) where uname -m returns 'aarch64' or 'arm64'. Changes: - Add OS/arch detection in 'Determine version' step using uname -s/-m - Map uname output to asset name format: x86_64→amd64, aarch64/arm64→arm64, linux→linux, darwin→darwin - Emit 'os' and 'arch' as step outputs alongside 'version' - Update cache key: review-bot-{os}-{arch}-{version} - Update Install step: BINARY derived from step outputs - Anchor checksum grep to exact filename (not substring match) - Unsupported OS or arch exits with a clear error message Supported platforms: linux-amd64, linux-arm64, darwin-amd64, darwin-arm64 (matches what the release workflow builds)	2026-05-14 05:45:20 +00:00